PT-2026-65625 · Goshs · Goshs

CVE-2026-66063 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.5

Description The multipart upload handler in the httpserver/updown.go file splits the part.FileName() on the path separator but fails to reject the .. sequence. This allows an unauthenticated user to upload a file with a filename of .., resulting in the creation of a file outside the served tree (webroot) via the os.Create() function. This occurs because the application does not validate if the final resolved destination remains within the intended upload folder.

Recommendations Update to version 2.1.5. Reject any upload filename that is .., is empty after sanitization, or resolves outside the upload folder. Validate the final resolved destination of the upload rather than only transforming the input.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-66063

GHSA-WG2Q-39H6-66X9

Affected Products

Goshs

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-66063 · Security Note
• https://osv.dev/vulnerability/GHSA-wg2q-39h6-66x9 · Vendor Advisory
• https://github.com/goshs-labs/goshs/security/advisories/GHSA-wg2q-39h6-66x9 · Note
• https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa · Note
• https://github.com/goshs-labs/goshs · Note